CVE-2019-19634: verot.net class.upload.php Unrestricted File Upload via .pht extension

CVE-2019-19634 · Severity: critical · CVSS 9.8 · Published 2020-02-28

A security vulnerability exists in a popular PHP file upload library used by various web applications, including the K2 extension for Joomla. The software fails to block certain dangerous file types, which could allow an attacker to upload and execute malicious code on the server. This could lead to a complete takeover of the website, theft of sensitive data, or disruption of services.

Technologies: JoomlaWorks K2, verot/class.upload.php (Packagist). Vendors: JoomlaWorks, Packagist.

Quick answers

Is CVE-2019-19634 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-19634 being exploited in the wild.
How severe is CVE-2019-19634?
Critical severity, with a CVSS score of 9.8, published 28 February 2020.
Which products and versions are affected?
JoomlaWorks K2 <= 2.10.1; verot/class.upload.php (Packagist) ECOSYSTEM:introduced=0,last_affected=1.0.3; Verot.Net Class.Upload.Php <= 1.0.3, 2.0.0 - 2.0.4.
Is there a fix for CVE-2019-19634?
A patch was published on 2019-12-07: Developer released a patch in version 2.0.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-19634 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2019-19634?
Check whether you run JoomlaWorks K2, verot/class.upload.php (Packagist) or Verot.Net Class.Upload.Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The class.upload.php library (through 1.0.3 and 2.0.4) utilizes a blacklist-based approach to filter dangerous file extensions. It omits the '.pht' extension from this list, which is a valid PHP execution handler on many server configurations (particularly Debian/Ubuntu). An unauthenticated remote attacker can bypass the filter by uploading a specially crafted image file containing a PHP payload with a .pht extension. While the library performs image transformations that typically destroy payloads, researchers have demonstrated that a brute-force approach can identify images where the payload survives processing, leading to Remote Code Execution (RCE). The issue is resolved in version 2.0.5.

Affected products

  • verot.net class.upload.php <= 1.0.3, 2.0.0 - 2.0.4
  • JoomlaWorks K2 <= 2.10.1

Identifiers

  • CVE-2019-19634
  • GHSA-2gc7-w4hw-rr2m

Timeline

  • 2019-12-07: disclosed: Reported to developer and JoomlaWorks
  • 2019-12-07: patched: Developer released a patch in version 2.0.5
  • 2019-12-17: advisory: NVD published CVE-2019-19634
  • 2020-02-28: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.